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1 This action is in response to the communication filed on 8/5/2005. 

2 DETAILED ACTION 

3 Election/Restrictions 

4 Restriction to one of the following inventions is required under 35 U.S.C. 121 : 

5 /. Claims 1-6], and 72-87, drawn to a system for mutually authenticating direct 

6 links between network devices, classified in class 713, subclass 201, subject matter further 

7 including means or steps for providing system security at network level. 

8 II. Claims 62-71 and 88-89, drawn to a method for mutually authenticating direct 

9 links between network devices including a distributed time service, classified in class 

10 713, subclass 169, subject matter wherein both a transmission and reception entity are 

1 1 determined to be genuine by each other. 

12 The inventions are distinct, each from the other because of the following reasons: 

13 Inventions I and II are related as combination and subcombination. Inventions in this 



14 relationship are distinct if it can be shown that (1) the combination as claimed does not require 

15 the particulars of the subcombination as claimed for patentability, and (2) that the 

16 subcombination has utility by itself or in other combinations (MPEP § 806.05(c)). In the instant 

17 case, the combination as claimed does not require the particulars of the subcombination as 

18 claimed because the combination does not require distribution of a MAC list to all nodes in the 

19 network, distributing a DCC list to all nodes in the network, or a three pass authentication 

20 scheme. The subcombination has separate utility such as mutual authentication between ports of 

21 devices in a network. 
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1 Because these inventions are distinct for the reasons given above and have acquired a 

2 separate status in the art because of their recognized divergent subject matter, restriction for 

3 examination purposes as indicated is proper. 

4 Applicant's election without traverse of Claims 1-61 and 72-87 in the reply filed on 

5 8/5/2005 is acknowledged. 
6 

7 Claims 1-61 and 72-87 have been examined and claims 62-71 and 88-89 have been 

8 cancelled. 

9 Title 

10 The title of the invention is acceptable. 

1 1 Priority 

12 This application has no priority claimed. 

13 Therefore, the effective filing date for the subject matter defined in the pending claims in 

14 this application is 1/3 1/2002, 

1 5 Drawings 

16 The drawings filed on 1/3 1/2002 are acceptable for examination proceedings. 

17 Claim Objections 

18 Claims 1-61 and 77, 79-87are objected to because of the following informalities: 

19 Claim 1 Line 4 should not be capitalized. 

20 Claim 1 Line 9 and Claim 35 Line 6 should recite "a communication media" not "an 

21 communication media". 

22 Claim 77 does not contain a period. 

23 Claim 79 contains multiple periods, including 2 in line 11. 
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1 Appropriate correction is required. 

2 

3 

4 Claim Rejections - 35 USC § 112 

5 The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

6 The specification shall conclude with one or more claims particularly pointing out and 

7 distinctly claiming the subject matter which the applicant regards as his invention. 
8 

9 Claims 1-61, 72, and 76-78 are rejected under 35 U.S.C. 1 12, second paragraph, as being 

10 indefinite for failing to particularly point out and distinctly claim the subject matter which 

1 1 applicant regards as the invention. 

12 The term "secure location" in claims 1, 13, is a relative term which renders the claim 

13 indefinite. The term "secure location" is not defined by the claim, the specification does not 

14 provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would 

1 5 not be reasonably apprised of the scope of the invention. In this particular instance, one of 

16 ordinary skill in the art would be unable to determine what constitutes u a secure location". For 

17 example, would a fireproof room be considered a secure location. Would a room anchored to the 

18 earth be considered a secure location. Would a plaza with armed guards be considered a secure 

19 location. As such, one of ordinary skill in the art would not be able to determine the scope of the 

20 claim. Therefore, claim 1 is rejected for failing to particularly point out and distinctly claim the 

21 subject matter which the applicant regards as the invention. 

22 The term "less secure location" in claims 1, 13 is a relative term which renders the claim 

23 indefinite. The term " less secure location" is not defined by the claim, the specification does not 

24 provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would 
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1 not be reasonably apprised of the scope of the invention. In this particular instance, one of 

2 ordinary skill in the art would be unable to determine what constitutes "a less secure location". 

3 For example, would a non-fireproof room be considered a less secure location. Would a room 

4 not anchored to the earth be considered a less secure location. Would a plaza with no armed 

5 guards be considered a less secure location. Furthermore, the claim gives no basis as to what the 

6 location is less secure than. As such, one of ordinary skill in the art would not be able to 

7 determine the scope of the claim. Therefore, claim 1 is rejected for failing to particularly point 

8 out and distinctly claim the subject matter which the applicant regards as the invention. 

9 The term "substantive" in claims 1, 18, 19, 35, 72, and 76 is a relative term which renders 

10 the claim indefinite. The term "substantive" is not defined by the claim, the specification does 

1 1 not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art 

12 would not be reasonably apprised of the scope of the invention. In this particular instance, one 

13 of ordinary skill in the art would be unable to determine what is considered substantive 

14 communication. As such, one of ordinary skill in the art would not be able to determine the 

15 scope of the claim. Therefore, claims 1,18, 19, 35, 72, and 76 are rejected for failing to 

16 particularly point out and distinctly claim the subject matter which the applicant regards as the 

17 invention. 

18 Claim 72 recites the limitation "said devices". There is insufficient antecedent basis for 

19 this limitation in the claim. 

20 Claims 2-34, 36-61, and 77-78 are rejected by virtue of their dependency to an above 

21 rejected claim. 

22 Claim Rejections - 35 USC §102 
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1 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 

2 basis for the rejections under this section made in this Office action: 

3 A person shall be entitled to a patent unless - 

4 (b) the invention was patented or described in a printed publication in this or a foreign 

5 country or in public use or on sale in this country, more than one year prior to the date of 

6 application for patent in the United States. 
? 

8 Claims 1-13, 17-19, 35- 47, 51-53, and 72-73 are rejected under 35 U.S.C. 102(b) as 

9 being anticipated by Sudama et al. (US Patent Number 5,619,657) hereinafter referred to as 

10 Sudama. 

1 1 Regarding claim 1, Sudama disclosed a method of operating a secure network having 



12 plurality of network nodes, each node comprising one or more ports (See Sudama Abstract), the 

13 method comprising the steps of: locating one or more nodes in a secure location (See Sudama 

14 Fig. 2); locating one or more nodes in a less secure location (See Sudama Col. 8 Paragraph 4); 



15 communicating selected management information from a primary configuration node to all other 

16 nodes in the secure network (See Sudama Col. 5 Paragraph 3), said communicating having the 

17 sub-steps of, a first port on a first node sending said management information to a second port on 

18 a second node via an communication media exclusively shared by said first port and said second 

19 port (See Sudama Col. 8 Paragraph 4 and Fig. 2); allowing no management access to said secure 

20 network from nodes located in said less secure locations (See Sudama Col. 8 Paragraph 4 and 

21 Fig. 2); determining a first list of nodes that may send or receive substantive communication in 

22 the secure network (See Sudama Col. 5 Paragraph 3); and prior to substantive communication 

23 between any two directly-connected ports, authenticating a link between said directly connected 

24 ports (See Sudama Col. 5 Paragraph 3). 
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1 Regarding claim 35, Sudama disclosed a specific networking node operating in a secure 

2 network, said secure network having a plurality of network nodes, each node comprising one or 

3 more ports (See Sudama Fig. 2 and Abstract), said specific networking node comprising: a first 

4 port on said specific networking node for receiving selected management information from a 

5 primary configuration node (See Sudama Col. 5 Paragraph 3 and Fig. 2), said first port directly 

6 communicating with a second port on a second node via an communication media exclusively 

7 shared by said first port and said second port (See Sudama Fig. 2 and Col. 8 Paragraph 4); a 

8 memory for storing (i) management access information (See Sudama Col. 8 Paragraph 1), and 

9 (ii) device connection information specifying nodes or ports that may send or receive substantive 

10 communication in the secure network (See Sudama Col. 8 Paragraph 1); and a processor for 

1 1 causing the authentication of the link between said first port and said second port prior to 

12 substantive communication between said first and second ports (See Sudama Col. 5 Paragraph 

13 3). 

14 Regarding claim 72, Sudama disclosed a method of securing a fabric, said fabric having a 

15 plurality of switches all communicatively coupled together, said method comprising the steps of: 

16 only allowing communication between pre-defined pairs of said devices as specified by a 

17 network operator (See Sudama Col. 5 Paragraph 3); and only allowing substantive 

1 8 communication between devices that are on a pre-defined list of allowed devices (See Sudama 

19 Col. 5 Paragraph 3), said pre-defined list stored on a memory in each of said plurality of devices 

20 (See Sudama Col. 8 Paragraph 1); and only allowing substantive communication between 

21 directly connected ports that have been mutually authenticated (See Sudama Col. 5 Paragraph 3). 
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1 Regarding claim 73, Sudama disclosed a network comprising: a plurality of devices 

2 including one or more switching and routing devices (See Sudama Col. 5 Paragraph 3), any two 

3 of said devices able to inter-communicate only by direct links between each other (See Sudama 

4 Fig. 2), all devices able to inter-communicate by forwarding communications through each other 

5 (See Sudama Col. 5 Paragraph 3); all of said devices capable of mutually authenticating directly 

6 connected links (See Sudama Col. 5 Paragraph 3); one or more pre-designated devices for 

7 facilitating management-level control of the network (See Sudama Col. 5 Paragraph 3); and all 

8 of said devices carrying a list of all devices allowed on the network (See Sudama Col. 8 

9 Paragraph 1). 

10 Regarding claims 2-12, and 36-46, Sudama disclosed that said primary configuration 

1 1 node is configured or adapted to exclusively control a defined set of management functions 

12 throughout said secure network (See Sudama Col. 5 Paragraph 3), said set of management 

13 functions comprising the recognition, operation and succession of primary configuration node 

14 (See Sudama Col. 5 Lines 20-21); node connection controls for designating nodes to participate 

15 in the secure network (See Sudama Col. 4 Lines 28-3 1), device connection controls that indicate 

16 port relationships in said secure network (See Sudama Col. 5 Lines 22-23), and management 

17 access controls that restrict management services to a defined set of endpoints (See Sudama Col. 

18 5 Lines 20-23). 

19 Regarding claims 13, and 47, Sudama disclosed that the step of allowing no management 

20 access to said secure network from nodes located in said less secure locations comprises the sub- 

21 step of distributing a MAC list to every node in said secure network, said MAC list comprising 
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1 an indication of network endpoints from which management access is acceptable (See Sudama 

2 Col. 5 Paragraph 3 and Fig. 2). 

3 Regarding claims 17 and 51, Sudama disclosed that the network endpoints comprise 

4 uniquely identified nodes resident in said secure network (See Sudama Fig. 2 and Col. 5 

5 Paragraph 3). 

6 Regarding claims 18 and 52, Sudama disclosed that the step of determining a first list of 



7 nodes that may send or receive substantive communication in the secure network comprises the 

8 sub-step of distributing a DCC list to every node in said secure network, said DCC list 

9 comprising definitions that logically bind a port on said primary configuration node to one or 

10 more other ports resident in the secure network (See Sudama Col. 5 Paragraph 3 and Col. 8 

1 1 Paragraph 1 and Fig. 2). 



12 Regarding claims 19 and 53, Sudama disclosed that the step of determining a first list of 

13 nodes that may send or receive substantive communication in the secure network comprises the 

14 sub-step of distributing a DCC list to every node in said secure network, said DCC list 

1 5 comprising definitions that logically bind each port in said secure network to one or more other 

16 ports resident in said network (See Sudama Col. 5 Paragraph 3 and Col. 8 Paragraph 1 and Fig. 

17 2). 

1 8 Claim Rejections - 35 USC §103 

19 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

20 obviousness rejections set forth in this Office action: 

21 A patent may not be obtained though the invention is not identically disclosed or 

22 described as set forth in section 102 of this title, if the differences between the subject matter 

23 sought to be patented and the prior art are such that the subject matter as a whole would have 

24 been obvious at the time the invention was made to a person having ordinary skill in the art to 
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1 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

2 the invention was made. 
3 

4 Claims 14-16, 20-21, and 48-50, and 54-55 are rejected under 35 U.S.C. 103(a) as being 

5 unpatentable over Sudama. Sudama disclosed distributing a list of management acceptable nodes 

6 in a network (See Sudama Col. 5 Paragraph 3), but failed to disclose that the nodes comprise IP 

7 addresses, that IP addresses are associated with SNMP or Telnet or HTTP or API, or that the 

8 nodes had ports which were uniquely identified by a world wide name. However, it was well 

9 known in the art at the time of invention that network nodes have IP addresses, that IP addresses 

10 are associated with access from SNMP or Telnet or HTTP or API, and that network ports were 

1 1 uniquely identified by a world wide name. . Therefore, it would have been obvious to the 

12 ordinary skill in the art at the time of invention to employ these well known networking features 

1 3 in the network of Sudama. 

14 Claims 22-31, 33-34, 56-61, and 76-87 are rejected under 35 U.S.C. 103(a) as being 

15 unpatentable over Sudama as applied to claim 1 above, and further in view of FIPS PUB 196 

16 ("Entity Authentication Using Public Key Cryptography") hereinafter referred to as FIPS. 

17 Regarding claims 22 and 56, Sudama disclosed mutual authentication performed between 

18 the network devices (See Sudama Col. 5 Paragraph 3) but failed to disclose the use of a three 

19 pass authentication scheme in order to do so. 

20 FIPS teaches a method for mutual authentication comprising sending a first fact (Rb) 

21 from said first port to said second port (See FIPS Section 3.3 Step 2); at said second node, 

22 creating a second-type derivative of said first fact (sSa), sending said second-type derivative of 

23 said first fact from said second port to said first port (See FIPS Section 3.3 Step 3); at said first 
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1 node, storing said second-type derivative of said first fact in a first memory; sending a second 

2 fact (R A ) from said second port to said first port (See FIPS Section 3.3 Step 3); at said first node, 

3 creating a first-type derivative of said second fact (sSb); sending said first-type derivative of said 

4 second fact from said first port to said second port (See FIPS Section 3.3 Step 5); at said second 

5 node, storing said first-type derivative of said second fact in a second memory; sending defined 

6 information concerning said first node (CertB) from said first port to said second port (See FIP S 

7 Section 3.3 Step 5); sending a third-type derivative of said defined information concerning said 

8 first node from said first port to said second port (It was well known that certificates included 

9 signatures of the hash of the certificate); at said second node, comparing said defined 

10 information concerning said first node with said third-type derivative of said defined information 

1 1 concerning said first node (It was also well known to verify the signature of the certificate at the 

12 receiver); at said second node, comparing said first type derivative of said second fact with said 

13 second fact (See FIPS Section 3.3 Step 6); sending defined information concerning said second 

14 node (Cert A) from said second port to said first port; sending a third-type derivative of said 

1 5 defined information concerning said second node from said second port to said first port (It was 

16 well that certificates included signatures of the hash of the certificate); at said first node, 

17 comparing said defined information concerning said second node with said third-type derivative 

18 of said defined information concerning said second node (It was also well known to verify the 

19 signature of the certificate at the receiver); and at said first node, comparing said second type 

20 derivative of said first fact with said first fact (See FIPS Section 3.3 Step 4). 

21 It would have been obvious to the ordinary person skilled in the art at the time of 

22 invention to employ the teachings of FEPS as the mutual authentication of Sudama. This would 
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1 have been obvious because the ordinary person skilled in the art would have been motivated to 

2 mutually authenticate the nodes prior to communication between the nodes. 

3 Regarding claim 76, the combination of Sudama and FLPS disclosed a routing device for 

4 receiving and directing information in a network (See Sudama Fig. 2), comprising: a public and 

5 private key pair (See FEPS Section 3.1 .4); one or more ports for coupling to other routing devices 

6 and for authenticating said other routing devices and for communicating using said public and 

7 private key pair (See Sudama Fig. 2 and Col. 5 Paragraph 3 and the rejection of claim 22 above); 

8 a memory for storing a list of all said other routing devices that are allowed to substantively 

9 communicate on the network (See Sudama Col. 8 Paragraph 1); and a least one logical 

10 management access channel that may be disabled through network management control (See 

1 1 Sudama Col. 8 Paragraph 4). 

12 Regarding claim 79, the combination of Sudama and FIPS disclosed a network 

13 configuration entity configured or adapted to exclusively control a defined set of management 

14 functions throughout a secure network, said secure network comprising a plurality of switching 

15 devices, said set of management functions comprising (i) the recognition, operation and 

16 succession of the network configuration entity and (ii) switch connection controls for designating 

17 devices to participate in the secure network (See Sudama Col. 5 Paragraph 3), said network 

18 configuration entity comprising; a memory for storing an NCE list, said NCE list comprising an 

19 indication of each device in the network that may operate as said network configuration entity 

20 (See Sudama Col. 5 Paragraph 3); an SCC list, said SCC list comprising an indication of each 

21 device allowed to participate in said secure network (See Sudama Col. 5 Paragraph 3); a first 

22 secret fact; a first port for sending said secret fact to a second switch; a second port for receiving, 
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1 a second-type derivative of said first secret fact from said second switch, pre-defined information 

2 about said second switch, and a third-type derivative of said pre-defined information about said 

3 second switch; and a processor for (i) causing a comparison between said first secret fact and 

4 said second-type derivative of said first secret fact, and (ii) causing a comparison between said 

5 pre-defined information about said second switch and said third-type derivative of said pre- 

6 defined information about said second switch (See the rejection of claim 22 above). 

7 Regarding claims 23, 33, 58, and 81, the combination of Sudama and FEPS disclosed that 

8 the step of comparing said defined information concerning said second node with said third-type 

9 derivative of said defined information concerning said second node, comprises the sub-steps of: 

10 reversing the derivation of the third-type derivative of said defined information concerning said 

1 1 second node; and comparing the result of said reversal with said defined information concerning 

12 said second node (It was well known at the time of invention that a signature was decrypted 

1 3 using the public key of the certificate authority and compared with the signed data to verify the 

14 signature). 

15 Regarding claims 24, 59, and 82, the combination of Sudama and FIPS disclosed that the 

16 step of comparing said defined information concerning said second node with said third-type 

17 derivative of said defined information concerning said second node, comprises the sub-steps of: 

18 making a third-type derivative of said defined information concerning said second node; and 

19 comparing the made third-type derivative with the received third-type derivative (It was well 

20 known at the time of invention that a signed hash was decrypted using the public key of the 

21 certificate authority and compared with the hash of the certificate to verify the signature). 
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1 Regarding claim 25-27, the combination of Sudama and FIPS disclosed that the step, at 

2 said second node, of creating a second-type derivative of said first fact comprises the sub-steps 

3 of: encoding said first fact to yield an encoded first fact; and encrypting said encoded first fact (It 

4 was well known at the time of invention that a signature was created by hashing the data to be 

5 signed and then encrypting the hash with a private key of a public key pair). 

6 Regarding claims 28-29, and 85, the combination of Sudama and FIPS disclosed that 

7 defined information concerning said first node comprises encryption key information and that 

8 encryption key information comprises a public key uniquely associated with said first node (See 

9 FIPS Section 3. 1.4). 

10 Regarding claims 30-31, 34, 61, and 84, the combination of Sudama and FIPS disclosed 

1 1 that the third-type derivative is created using a private key uniquely associated with an 

12 encryption key authority, said encryption key authority associated with said first node and said 

13 second node (See FIPS Section 3.1.4). 

14 Regarding claims 57, and 80, Sudama and FIPS disclosed that the third port and the 

1 5 fourth port are the same port (See Sudama Fig. 2). 

16 Regarding claim 60, Sudama and FIPS disclosed that the second-type derivative is 

17 associated with the third node (See FIPS Section 3.3 Step 3). 

18 Regarding claim 77, Sudama and FIPS disclosed that the certificate authority for the 

19 public and private key pair is not the entity controlling management access to said routing device 

20 (See FIPS Section 3.1.4). 



Application/Control Number: 1 0/062, 1 25 Page 1 5 

Art Unit: 2131 



1 Regarding claim 78, Sudama and FIPS disclosed a memory for storing distributed time 

2 service information (It was well known in the art for network devices to contain network time 

3 service information). 

4 Regarding claim 83, Sudama and FIPS disclosed that the second-type derivative is 

5 associated with said second switch (See FIPS Section 3.3). 

6 Regarding claims 86-87, Sudama and FIPS disclosed that the first secret fact is a random 

7 nonce (See FIPS Section 3.3). 

8 Claim 32 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sudama and FIPS 

9 as applied to claim 30 above, and further in view of Fischer (US Patent Number 5,422,953). 

10 Sudama and FIPS disclosed the use of certificates (See the rejection of claim 22 above), 

1 1 but failed to disclose the certificate being issued by the manufacturer of the node devices. 

12 Fischer teaches that a manufacturer of a device can also be the issuer of the devices 

13 public key certificate (See Fischer Col. 6 Paragraph 3). 

14 It would have been obvious to the ordinary person skilled in the art at the time of 

15 invention to employ the teachings of Fischer in the network system of Sudama and FIPS by 

16 having the manufacturer of the network devices issue the certificates to the devices. This would 

17 have been obvious because the ordinary person skilled in the art would have been motivated to 

18 provide assurance through the certificate that network device was secure. 

19 Claim 74 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sudama as 

20 applied to claim 73 above, and further in view of Thapar et al. (US Patent Number 5,694,615) 

21 hereinafter referred to as Thapar. 
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1 Sudama disclosed a network of routers (See Sudama Fig. 2), but failed to disclose the 

2 system being used in a fibre channel 

3 Thapar teaches that the fibre channel addresses the need for very fast data transfers (See 

4 Thapar Col. 1 Lines 18-26). 

5 It would have been obvious to the ordinary person skilled in the art at the time of 



6 invention to employ the teachings of Thapar in the communication network of Sudama by 

7 replacing the routers of Thapar with Fibre Channel routers. This would have been obvious 

8 because the ordinary person skilled in the art would have been motivated to allow for very fast 

9 transfers of large volumes of data. 



10 Claim 75 is rejected under 35 U.S.C. 103(a) as being unpatentable over Sudama as 

1 1 applied to claim 73 above, and further in view of applicant admitted prior art. 

12 Sudama disclosed a network of routers (See Sudama Fig. 2), but failed to disclose the 

13 routers being in locked rooms. 

14 Applicants admitted on page 2 paragraph 2 of the specification that the prior art secured 

15 computer equipment by locking it in a room. 

16 It would have been obvious to the ordinary person skilled in the art at the time of 

17 invention to employ the teachings of the applicants' admitted prior art in the networking system 

18 of Sudama by locking the management devices in rooms. This would have been obvious 

19 because the ordinary person skilled in the art would have been motivated to protect the devices 

20 against tampering and theft. 

21 Conclusion 

22 Claims 1-61 and 72-87 have been rejected. 
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The prior art made of record and not relied upon is considered pertinent to applicant's 



2 



disclosure. 



3 



a. 



Schneier ("Applied Cryptography") disclosed methods for verifying certificates 



4 



and digital signatures. 



5 



Any inquiry concerning this communication or earlier communications from the 



6 examiner should be directed to Matthew T. Henning whose telephone number is (571) 272-3790. 

7 The examiner can normally be reached on M-F 8-4. 



9 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
10 organization where this application or proceeding is assigned is 571-273-8300. 



12 Application Information Retrieval (PAIR) system. Status information for published applications 

13 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

14 applications is available through Private PAIR only. For more information about the PAIR 

15 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

16 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



8 



If attempts to reach the examiner by telephone are unsuccessful, the examiner's 



11 



Information regarding the status of an application may be obtained from the Patent 



17 
18 
19 
20 
21 





25 
26 
27 
28 



Matthew Henning 
Assistant Examiner 
Art Unit 2131 
10/24/2005 



